CVE-2021-23002

When using BIG-IP APM 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, or all 12.1.x and 11.6.x versions or Edge Client versions 7.2.1.x before 7.2.1.1, 7.1.9.x before 7.1.9.8, or 7.1.8.x before 7.1.8.5, the session ID is visible in the arguments of the f5vpn.exe command when VPN is launched from the browser on a Windows system. Addressing this issue requires both the client and server fixes. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.

CVSS v3 4.5 MEDIUM
CVSS v2.0 2.7 LOW

4.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.9 / Impact : 3.6

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

2.7^/10

CVSS v2.0 : LOW

Vector : AV:A/AC:L/Au:S/C:P/I:N/A:N

Exploitability : 5.1 / Impact : 2.9

Access Vector ADJACENT_NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://support.f5.com/csp/article/K71891773	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:f5:access_policy_manager_clients::::::::
	cpe:2.3:a:f5:access_policy_manager_clients::::::::
	cpe:2.3:a:f5:access_policy_manager_clients::::::::
	cpe:2.3:a:f5:big-ip_access_policy_manager::::::::
	cpe:2.3:a:f5:big-ip_access_policy_manager::::::::
	cpe:2.3:a:f5:big-ip_access_policy_manager::::::::
	cpe:2.3:a:f5:big-ip_access_policy_manager::::::::
	cpe:2.3:a:f5:big-ip_access_policy_manager::::::::
	cpe:2.3:a:f5:big-ip_access_policy_manager::::::::

History

No history.

Information

Published : 2021-03-31 18:15

Updated : 2024-02-04 21:47

NVD link : CVE-2021-23002

Mitre link : CVE-2021-23002

CVE.ORG link : CVE-2021-23002

JSON object : View

Products Affected

f5

big-ip_access_policy_manager
access_policy_manager_clients

CWE

NVD-CWE-noinfo

{"id": "CVE-2021-23002", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.7, "accessVector": "ADJACENT_NETWORK", "vectorString": "AV:A/AC:L/Au:S/C:P/I:N/A:N", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 5.1, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.5, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 0.9}]}, "published": "2021-03-31T18:15:15.380", "references": [{"url": "https://support.f5.com/csp/article/K71891773", "tags": ["Vendor Advisory"], "source": "f5sirt@f5.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "When using BIG-IP APM 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, or all 12.1.x and 11.6.x versions or Edge Client versions 7.2.1.x before 7.2.1.1, 7.1.9.x before 7.1.9.8, or 7.1.8.x before 7.1.8.5, the session ID is visible in the arguments of the f5vpn.exe command when VPN is launched from the browser on a Windows system. Addressing this issue requires both the client and server fixes. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated."}, {"lang": "es", "value": "Cuando se usa BIG-IP APM versiones 16.0.x anteriores a 16.0.1.1, versiones 15.1.x anteriores a 15.1.2.1, versiones 14.1.x anteriores a 14.1.4, versiones 13.1.x anteriores a 13.1.3.6, o todas las versiones 12.1.x y 11.6.x o Edge Client versiones 7.2.1.x anteriores a 7.2.1.1, versiones 7.1.9.x anteriores a 7.1.9.8 o versiones 7.1.8.x anteriores a 7.1.8.5, el ID de sesi\u00f3n es visible en los argumentos del comando f5vpn.exe cuando VPN est\u00e1 iniciado desde el navegador en un sistema Windows. Abordar este problema requiere correcciones tanto del cliente como del servidor. Nota: No se eval\u00faan las versiones de software que han alcanzado End of Software Development (EoSD)."}], "lastModified": "2021-04-05T17:39:12.527", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:f5:access_policy_manager_clients:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8BBCE39D-283C-4D80-A83D-D4C94F2C4D92", "versionEndExcluding": "7.1.8.5", "versionStartIncluding": "7.1.5"}, {"criteria": "cpe:2.3:a:f5:access_policy_manager_clients:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6CB004A6-19ED-43E4-BE0B-76A742120B7D", "versionEndExcluding": "7.1.9.8", "versionStartIncluding": "7.1.9"}, {"criteria": "cpe:2.3:a:f5:access_policy_manager_clients:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B60E89ED-5C0A-4B21-A5C5-2F902E4A2891", "versionEndExcluding": "7.2.1.1", "versionStartIncluding": "7.2.1"}, {"criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2FBA9552-4645-4BFF-91A4-47B6A3414325", "versionEndIncluding": "11.6.5", "versionStartIncluding": "11.6.1"}, {"criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6C3B5688-0235-4D4F-A26C-440FF24A1B43", "versionEndIncluding": "12.1.5", "versionStartIncluding": "12.1.0"}, {"criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8C3A0A32-E425-4939-A30D-95A046ABBABB", "versionEndExcluding": "13.1.3.6", "versionStartIncluding": "13.1.0"}, {"criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FB553A20-D521-4A32-AD49-8FFD5A95E684", "versionEndExcluding": "14.1.4", "versionStartIncluding": "14.1.0"}, {"criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6ED8C663-038B-4071-9FF9-AE609F2DA4CD", "versionEndExcluding": "15.1.2.1", "versionStartIncluding": "15.1.0"}, {"criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A7706F70-BF89-480E-9AA6-3FE447375138", "versionEndExcluding": "16.0.1.1", "versionStartIncluding": "16.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "f5sirt@f5.com"}